Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

multiple SVCHOST.EXE hog memory


  • Please log in to reply
14 replies to this topic

#1 dashizen

dashizen

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:FL
  • Local time:08:23 AM

Posted 14 April 2012 - 05:09 PM

Hey Everyone,

Just trying to find some answers and get my computer running at the best performance it can until I can afford to upgrade it or just completely replace it.

My computer is old, but I'm not in a position financially to go out and get a new one. This is all I have, and I know I can get jobs and generate income using it, so I'm spending my time fixing it up and trying to get rid of whatever's slowing it down (though I know that there's only so much you can do with such a low amount of RAM).

If I had the money, I would probably purchase some quick-fix software online, but I don't. So I'm FORCED to do this all on my own. We'll see how it goes.

Good luck to everyone out there. Hope everyone's enjoying their life, and that at the end of all this, I'll be able to write about my experience and help other people with the same problems as me.

-Tiffany

Ok..I'm trying to get help with whatever virus I have on my computer that generates multiple SVCHOST.EXE files that pop back up in the list of processes right after I end them. These are the instructions I am following that I am doing because they were on a "SVCHOST.EXE hogging CPU" post". I'm probably going about this all the wrong way but here it goes:



You should also scan the PC.

Please download MiniToolBox, save it to your desktop and run it.

Checkmark the following checkboxes:

• Flush DNS
• Report IE Proxy Settings
• Reset IE Proxy Settings
• Report FF Proxy Settings
• Reset FF Proxy Settings
• List content of Hosts
• List IP configuration
• List Winsock Entries
• List last 10 Event Viewer log
• List Installed Programs
• List Users, Partitions and Memory size.
• List Minidump Files

Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using "Reset FF Proxy Settings" option Firefox should be closed.


Next run MBAM (MalwareBytes):

Please download Malwarebytes Anti-Malware and save it to your desktop.

Download Link 1
Download Link 2
MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.
• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exeto install the application.
For instructions with screenshots, please refer to the How to use Malwarebytes' Anti-Malware Guide.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
o Update Malwarebytes' Anti-Malware
o Launch Malwarebytes' Anti-Malware

• Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
• Make sure the "Perform Quick Scan" option is selected.
• Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scanbutton.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
• Click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking theLogs tab in MBAM.
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
• Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Troubleshoot Malwarebytes' Anti-Malware

Please download GMER from one of the following locations and save it to your desktop:
• Main Mirror
This version will download a randomly named file (Recommended)
• Zipped Mirror
This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.


• Disconnect from the Internet and close all running programs.
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.


• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
• Now click the Scan button. If you see a rootkit warning window, click OK.
• When the scan is finished, click theSave... button to save the scan results to your Desktop. Save the file as gmer.log.
• Click the Copy button and paste the results into your next reply.
• Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.
-- If you encounter any problems, try running GMER in safe mode.
-- If GMER crashes or keeps resulting in a BSODs, uncheck Devices on the right side before scanning.


Hey there to whoever can help...I've done the first 2 steps in trying to get rid of this memory hogging virus on my computer. I ran the MiniToolBox.exe and checkmarked all the boxes and here is the log I get:

MiniToolBox by Farbar Version: 18-01-2012
Ran by oem (administrator) on 14-04-2012 at 17:50:00
Microsoft Windows XP Professional Service Pack 2 (X86)
Boot Mode: Normal
***************************************************************************

========================= Flush DNS: ===================================


Windows IP Configuration



Successfully flushed the DNS Resolver Cache.


========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.

========================= FF Proxy Settings: ==============================


"Reset FF Proxy Settings": Firefox Proxy settings were reset.

========================= Hosts content: =================================

127.0.0.1 localhost

========================= IP Configuration: ================================

Realtek RTL8139 Family PCI Fast Ethernet NIC = Local Area Connection 5 (Connected)
Realtek RTL8139 Family PCI Fast Ethernet NIC = Local Area Connection 4 (Media disconnected)


# ----------------------------------
# Interface IP Configuration
# ----------------------------------
pushd interface ip


# Interface IP Configuration for "Local Area Connection 5"

set address name="Local Area Connection 5" source=dhcp
set dns name="Local Area Connection 5" source=dhcp register=PRIMARY
set wins name="Local Area Connection 5" source=dhcp

# Interface IP Configuration for "Local Area Connection 4"

set address name="Local Area Connection 4" source=dhcp
set dns name="Local Area Connection 4" source=dhcp register=PRIMARY
set wins name="Local Area Connection 4" source=dhcp


popd
# End of interface IP configuration




Windows IP Configuration



Host Name . . . . . . . . . . . . : u9j7v0

Primary Dns Suffix . . . . . . . :

Node Type . . . . . . . . . . . . : Unknown

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No



Ethernet adapter Local Area Connection 5:



Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Realtek RTL8139 Family PCI Fast Ethernet NIC #3

Physical Address. . . . . . . . . : 00-0F-EA-D5-34-24

Dhcp Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . : 192.168.0.10

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 192.168.0.1

DHCP Server . . . . . . . . . . . : 192.168.0.1

DNS Servers . . . . . . . . . . . : 65.32.5.111

65.32.5.112

Lease Obtained. . . . . . . . . . : Saturday, April 14, 2012 4:14:51 PM

Lease Expires . . . . . . . . . . : Saturday, April 14, 2012 5:14:51 PM



Ethernet adapter Local Area Connection 4:



Media State . . . . . . . . . . . : Media disconnected

Description . . . . . . . . . . . : Realtek RTL8139 Family PCI Fast Ethernet NIC #2

Physical Address. . . . . . . . . : 00-08-54-24-D3-DE

Server: dns-redir-lb-01.tampabay.rr.com
Address: 65.32.5.111

Name: google.com
Addresses: 74.125.47.139, 74.125.47.100, 74.125.47.101, 74.125.47.102
74.125.47.113, 74.125.47.138



Pinging google.com [74.125.47.101] with 32 bytes of data:



Reply from 74.125.47.101: bytes=32 time=57ms TTL=51

Reply from 74.125.47.101: bytes=32 time=55ms TTL=51



Ping statistics for 74.125.47.101:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 55ms, Maximum = 57ms, Average = 56ms

Server: dns-redir-lb-01.tampabay.rr.com
Address: 65.32.5.111

Name: yahoo.com
Addresses: 98.139.183.24, 209.191.122.70, 72.30.38.140



Pinging yahoo.com [98.139.183.24] with 32 bytes of data:



Reply from 98.139.183.24: bytes=32 time=139ms TTL=48

Reply from 98.139.183.24: bytes=32 time=124ms TTL=47



Ping statistics for 98.139.183.24:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 124ms, Maximum = 139ms, Average = 131ms

Server: dns-redir-lb-01.tampabay.rr.com
Address: 65.32.5.111

Name: bleepingcomputer.com
Address: 208.43.87.2



Pinging bleepingcomputer.com [208.43.87.2] with 32 bytes of data:



Reply from 208.43.87.2: Destination host unreachable.

Reply from 208.43.87.2: Destination host unreachable.



Ping statistics for 208.43.87.2:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms



Pinging 127.0.0.1 with 32 bytes of data:



Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128



Ping statistics for 127.0.0.1:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms

===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x10003 ...00 0f ea d5 34 24 ...... Realtek RTL8139 Family PCI Fast Ethernet NIC #3
0x10004 ...00 08 54 24 d3 de ...... Realtek RTL8139 Family PCI Fast Ethernet NIC #2
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.10 20
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.0.0 255.255.255.0 192.168.0.10 192.168.0.10 20
192.168.0.10 255.255.255.255 127.0.0.1 127.0.0.1 20
192.168.0.255 255.255.255.255 192.168.0.10 192.168.0.10 20
224.0.0.0 240.0.0.0 192.168.0.10 192.168.0.10 20
255.255.255.255 255.255.255.255 192.168.0.10 10004 1
255.255.255.255 255.255.255.255 192.168.0.10 192.168.0.10 1
Default Gateway: 192.168.0.1
===========================================================================
Persistent Routes:
None
========================= Winsock entries =====================================

Catalog5 01 C:\Windows\System32\mswsock.dll [245248] (Microsoft Corporation)
Catalog5 02 C:\Windows\System32\winrnr.dll [16896] (Microsoft Corporation)
Catalog5 03 C:\Windows\System32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 01 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 02 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 03 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 04 C:\Windows\system32\rsvpsp.dll [90112] (Microsoft Corporation)
Catalog9 05 C:\Windows\system32\rsvpsp.dll [90112] (Microsoft Corporation)
Catalog9 06 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 07 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 08 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 09 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 10 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 11 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 12 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 13 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 14 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 15 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 16 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 17 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 18 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 19 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 20 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 21 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)

========================= Event log errors: ===============================

Application errors:
==================
Error: (04/14/2012 05:28:29 PM) (Source: LoadPerf) (User: )
Description: The performance counter name string value in the registry is incorrectly
formatted. The bogus string is 4534, the bogus index value is the first
DWORD in Data section while the last valid index values are the second and
third DWORD in Data section.

Error: (04/14/2012 05:28:18 PM) (Source: LoadPerf) (User: )
Description: Unloading the performance counter strings for service ASP.NET_2.0.50727 (ASP.NET_2.0.50727) failed. The
Error code is the first DWORD in Data section.

Error: (04/14/2012 05:28:18 PM) (Source: LoadPerf) (User: )
Description: The performance counter name string value in the registry is incorrectly
formatted. The bogus string is 4534, the bogus index value is the first
DWORD in Data section while the last valid index values are the second and
third DWORD in Data section.

Error: (04/13/2012 01:38:36 PM) (Source: Application Hang) (User: )
Description: Hanging application iexplore.exe, version 6.0.2900.2180, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (04/13/2012 01:21:31 PM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root certificate from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25.crt> with error: The specified server cannot perform the requested operation.

Error: (04/13/2012 01:21:31 PM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root certificate from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25.crt> with error: The specified server cannot perform the requested operation.

Error: (04/13/2012 01:21:31 PM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root certificate from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25.crt> with error: The specified server cannot perform the requested operation.

Error: (04/13/2012 01:21:31 PM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root certificate from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25.crt> with error: This operation returned because the timeout period expired.

Error: (04/13/2012 01:18:10 PM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root certificate from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/02FAF3E291435468607857694DF5E45B68851868.crt> with error: The specified server cannot perform the requested operation.

Error: (04/13/2012 01:18:09 PM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root certificate from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/02FAF3E291435468607857694DF5E45B68851868.crt> with error: The specified server cannot perform the requested operation.


System errors:
=============
Error: (04/14/2012 05:18:05 PM) (Source: Service Control Manager) (User: )
Description: The Automatic Updates service terminated unexpectedly. It has done this 2 time(s).

Error: (04/14/2012 05:18:05 PM) (Source: Service Control Manager) (User: )
Description: The Windows Management Instrumentation service terminated unexpectedly. It has done this 6 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (04/14/2012 05:18:05 PM) (Source: Service Control Manager) (User: )
Description: The Windows Time service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (04/14/2012 05:18:05 PM) (Source: Service Control Manager) (User: )
Description: The System Event Notification service terminated unexpectedly. It has done this 5 time(s).

Error: (04/14/2012 05:18:05 PM) (Source: Service Control Manager) (User: )
Description: The Network Location Awareness (NLA) service terminated unexpectedly. It has done this 6 time(s).

Error: (04/14/2012 05:18:05 PM) (Source: Service Control Manager) (User: )
Description: The COM+ Event System service terminated unexpectedly. It has done this 6 time(s).

Error: (04/14/2012 05:18:05 PM) (Source: Service Control Manager) (User: )
Description: The Background Intelligent Transfer Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (04/14/2012 04:26:26 PM) (Source: Service Control Manager) (User: )
Description: The Server service terminated unexpectedly. It has done this 1 time(s).

Error: (04/14/2012 04:26:26 PM) (Source: Service Control Manager) (User: )
Description: The Help and Support service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.

Error: (04/14/2012 01:12:41 PM) (Source: Service Control Manager) (User: )
Description: The Server service terminated unexpectedly. It has done this 1 time(s).


Microsoft Office Sessions:
=========================
Error: (04/14/2012 05:28:29 PM) (Source: LoadPerf)(User: )
Description: 4534

Error: (04/14/2012 05:28:18 PM) (Source: LoadPerf)(User: )
Description: ASP.NET_2.0.50727ASP.NET_2.0.50727

Error: (04/14/2012 05:28:18 PM) (Source: LoadPerf)(User: )
Description: 4534

Error: (04/13/2012 01:38:36 PM) (Source: Application Hang)(User: )
Description: iexplore.exe6.0.2900.2180hungapp0.0.0.000000000

Error: (04/13/2012 01:21:31 PM) (Source: crypt32)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25.crtThe specified server cannot perform the requested operation.

Error: (04/13/2012 01:21:31 PM) (Source: crypt32)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25.crtThe specified server cannot perform the requested operation.

Error: (04/13/2012 01:21:31 PM) (Source: crypt32)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25.crtThe specified server cannot perform the requested operation.

Error: (04/13/2012 01:21:31 PM) (Source: crypt32)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25.crtThis operation returned because the timeout period expired.

Error: (04/13/2012 01:18:10 PM) (Source: crypt32)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/02FAF3E291435468607857694DF5E45B68851868.crtThe specified server cannot perform the requested operation.

Error: (04/13/2012 01:18:09 PM) (Source: crypt32)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/02FAF3E291435468607857694DF5E45B68851868.crtThe specified server cannot perform the requested operation.


=========================== Installed Programs ============================

Adobe Flash Player 11 ActiveX (Version: 11.1.102.63)
Adobe Flash Player 11 Plugin (Version: 11.2.202.228)
Adobe Reader 7.0.5 (Version: 7.0.5)
AT&T WorldNet Setup 1.2
C-Media WDM Audio Driver
Google Chrome (Version: 18.0.1025.162)
KLE&PLE and Utilities
Malwarebytes Anti-Malware version 1.61.0.1400 (Version: 1.61.0.1400)
Memories Disc Creator 2.0 (Version: 2.0.479.1607)
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 2.0
Microsoft .NET Framework 2.0 (Version: 2.0.50727)
Microsoft Office Professional Edition 2003 (Version: 11.0.7969.0)
Microsoft Pandora's Box
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Move Networks Media Player for Internet Explorer
Mozilla Firefox 11.0 (x86 en-US) (Version: 11.0)
MSVC80_x86 (Version: 1.0.1.0)
MSXML 4.0 SP2 (KB927978) (Version: 4.20.9841.0)
MSXML 4.0 SP2 (KB936181) (Version: 4.20.9848.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MSXML 4.0 SP2 Parser and SDK (Version: 4.20.9818.0)
Nero Express (Version: 5.5.9)
ParetoLogic PC Health Advisor (Version: 3.1.2.0)
PC Connectivity Solution (Version: 7.37.22.0)
Quicken 2006 (Version: 15.1.4.5)
QuickTime for Windows (32-bit)
RealPlayer Basic
S3 S3Display
S3 S3Gamma2
S3 S3Info2
S3 S3Overlay
SpeedyPC Pro (Version: 3.0.0.0)
Update for Windows XP (KB898461) (Version: 1)
Update for Windows XP (KB900485) (Version: 2)
Update for Windows XP (KB910437) (Version: 1)
Update for Windows XP (KB916595) (Version: 1)
Update for Windows XP (KB920872) (Version: 1)
Update for Windows XP (KB922582) (Version: 1)
Update for Windows XP (KB927891) (Version: 3)
Update for Windows XP (KB930916) (Version: 1)
Update for Windows XP (KB931836) (Version: 1)
Update for Windows XP (KB938828) (Version: 1)
Update for Windows XP (KB973815) (Version: 1)
WebFldrs XP (Version: 9.50.6513)
Windows Driver Package - Nokia Modem (10/12/2007 3.6) (Version: 10/12/2007 3.6)
Windows Genuine Advantage Notifications (KB905474) (Version: 1.5.0532.2)
Windows Genuine Advantage v1.3.0254.0 (Version: 1.3.0254.0)
Windows Installer 3.1 (KB893803) (Version: 3.1)
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB873339 (Version: 20041117.092459)
Windows XP Hotfix - KB885250 (Version: 20050118.202711)
Windows XP Hotfix - KB885835 (Version: 20041027.181713)
Windows XP Hotfix - KB885836 (Version: 20041028.173203)
Windows XP Hotfix - KB885884 (Version: 20040924.025457)
Windows XP Hotfix - KB886185 (Version: 20041021.090540)
Windows XP Hotfix - KB887472 (Version: 20041014.162858)
Windows XP Hotfix - KB887742 (Version: 20041103.095002)
Windows XP Hotfix - KB888113 (Version: 20041116.131036)
Windows XP Hotfix - KB888302 (Version: 20041207.111426)
Windows XP Hotfix - KB890859 (Version: 1)
Windows XP Hotfix - KB891781 (Version: 20050110.165439)
Windows XP Service Pack 2 (Version: 20040803.231319)

========================= Devices: ================================

Name: ACPI Uniprocessor PC
Description: ACPI Uniprocessor PC
Class Guid: {4D36E966-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard computers)
Service: \Driver\ACPI_HAL

Name: Microsoft ACPI-Compliant System
Description: Microsoft ACPI-Compliant System
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: Microsoft
Service: ACPI

Name: AMD Processor Model Unknown
Description: Processor
Class Guid: {50127DC3-0F36-415E-A6CC-4CB3BE910B65}
Manufacturer: (Standard processor types)
Service: Processor

Name: ACPI Power Button
Description: ACPI Power Button
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service:

Name: System board
Description: System board
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service:

Name: PCI bus
Description: PCI bus
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service: pci

Name: VIA Standard Host Bridge
Description: VIA Standard Host Bridge
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: VIA
Service:

Name: VIA Standard Host Bridge
Description: VIA Standard Host Bridge
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: VIA
Service:

Name: VIA Standard Host Bridge
Description: VIA Standard Host Bridge
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: VIA
Service:

Name: VIA Standard Host Bridge
Description: VIA Standard Host Bridge
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: VIA
Service:

Name: VIA Standard Host Bridge
Description: VIA Standard Host Bridge
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: VIA
Service:

Name: VIA Standard Host Bridge
Description: VIA Standard Host Bridge
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: VIA
Service:

Name: VIA CPU to AGP2.0/AGP3.0 Controller
Description: VIA CPU to AGP2.0/AGP3.0 Controller
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: VIA
Service: pci

Name: VIA/S3G UniChromeII Graphics
Description: VIA/S3G UniChromeII Graphics
Class Guid: {4D36E968-E325-11CE-BFC1-08002BE10318}
Manufacturer: VIA/S3 Graphics, Inc.
Service: viagfx

Name: Plug and Play Monitor
Description: Plug and Play Monitor
Class Guid: {4D36E96E-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard monitor types)
Service:

Name: Realtek RTL8139 Family PCI Fast Ethernet NIC #2
Description: Realtek RTL8139 Family PCI Fast Ethernet NIC
Class Guid: {4D36E972-E325-11CE-BFC1-08002BE10318}
Manufacturer: Realtek
Service: rtl8139

Name: U.S. Robotics 56K Fax Win
Description: U.S. Robotics 56K Fax Win
Class Guid: {4D36E96D-E325-11CE-BFC1-08002BE10318}
Manufacturer: U.S. Robotics Corporation
Service: Modem

Name: RAID Controller
Description: RAID Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: VIA Bus Master IDE Controller
Description: VIA Bus Master IDE Controller
Class Guid: {4D36E96A-E325-11CE-BFC1-08002BE10318}
Manufacturer: VIA Technologies, Inc.
Service: viaide

Name: Primary IDE Channel
Description: Primary IDE Channel
Class Guid: {4D36E96A-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard IDE ATA/ATAPI controllers)
Service: atapi

Name: Maxtor 2B020H1
Description: Disk drive
Class Guid: {4D36E967-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard disk drives)
Service: disk

Name: Secondary IDE Channel
Description: Secondary IDE Channel
Class Guid: {4D36E96A-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard IDE ATA/ATAPI controllers)
Service: atapi

Name: VIA Rev 5 or later USB Universal Host Controller
Description: VIA Rev 5 or later USB Universal Host Controller
Class Guid: {36FC9E60-C465-11CF-8056-444553540000}
Manufacturer: VIA Technologies
Service: usbuhci

Name: USB Root Hub
Description: USB Root Hub
Class Guid: {36FC9E60-C465-11CF-8056-444553540000}
Manufacturer: (Standard USB Host Controller)
Service: usbhub

Name: VIA Rev 5 or later USB Universal Host Controller
Description: VIA Rev 5 or later USB Universal Host Controller
Class Guid: {36FC9E60-C465-11CF-8056-444553540000}
Manufacturer: VIA Technologies
Service: usbuhci

Name: USB Root Hub
Description: USB Root Hub
Class Guid: {36FC9E60-C465-11CF-8056-444553540000}
Manufacturer: (Standard USB Host Controller)
Service: usbhub

Name: VIA Rev 5 or later USB Universal Host Controller
Description: VIA Rev 5 or later USB Universal Host Controller
Class Guid: {36FC9E60-C465-11CF-8056-444553540000}
Manufacturer: VIA Technologies
Service: usbuhci

Name: USB Root Hub
Description: USB Root Hub
Class Guid: {36FC9E60-C465-11CF-8056-444553540000}
Manufacturer: (Standard USB Host Controller)
Service: usbhub

Name: VIA Rev 5 or later USB Universal Host Controller
Description: VIA Rev 5 or later USB Universal Host Controller
Class Guid: {36FC9E60-C465-11CF-8056-444553540000}
Manufacturer: VIA Technologies
Service: usbuhci

Name: USB Root Hub
Description: USB Root Hub
Class Guid: {36FC9E60-C465-11CF-8056-444553540000}
Manufacturer: (Standard USB Host Controller)
Service: usbhub

Name: Standard Enhanced PCI to USB Host Controller
Description: Standard Enhanced PCI to USB Host Controller
Class Guid: {36FC9E60-C465-11CF-8056-444553540000}
Manufacturer: (Standard USB Host Controller)
Service: usbehci

Name: USB Root Hub
Description: USB Root Hub
Class Guid: {36FC9E60-C465-11CF-8056-444553540000}
Manufacturer: (Standard USB Host Controller)
Service: usbhub

Name: VIA Standard PCI to ISA Bridge
Description: VIA Standard PCI to ISA Bridge
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: VIA
Service: isapnp

Name: ISAPNP Read Data Port
Description: ISAPNP Read Data Port
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service:

Name: C-Media AC97 Audio Device
Description: C-Media AC97 Audio Device
Class Guid: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Manufacturer: C-Media
Service: cmuda
Problem: : Windows cannot load the device driver for this hardware. The driver may be corrupted or missing. (Code 39)
Resolution: Reasons for this error include a driver that is not present; a binary file that is corrupt; a file I/O problem, or a driver that references an entry point in another binary file that could not be loaded.
Uninstall the driver, and then click "Scan for hardware changes" to reinstall or upgrade the driver.

Name: Realtek RTL8139 Family PCI Fast Ethernet NIC #3
Description: Realtek RTL8139 Family PCI Fast Ethernet NIC
Class Guid: {4D36E972-E325-11CE-BFC1-08002BE10318}
Manufacturer: Realtek
Service: rtl8139

Name: PCI standard host CPU bridge
Description: PCI standard host CPU bridge
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service:

Name: PCI standard host CPU bridge
Description: PCI standard host CPU bridge
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service:

Name: PCI standard host CPU bridge
Description: PCI standard host CPU bridge
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service:

Name: PCI standard host CPU bridge
Description: PCI standard host CPU bridge
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service:

Name: Motherboard resources
Description: Motherboard resources
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service:

Name: Motherboard resources
Description: Motherboard resources
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service:

Name: Programmable interrupt controller
Description: Programmable interrupt controller
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service:

Name: Direct memory access controller
Description: Direct memory access controller
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service:

Name: System timer
Description: System timer
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service:

Name: System CMOS/real time clock
Description: System CMOS/real time clock
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service:

Name: System speaker
Description: System speaker
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service:

Name: Numeric data processor
Description: Numeric data processor
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service:

Name: Standard floppy disk controller
Description: Standard floppy disk controller
Class Guid: {4D36E969-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard floppy disk controllers)
Service: fdc

Name: Floppy disk drive
Description: Floppy disk drive
Class Guid: {4D36E980-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard floppy disk drives)
Service: flpydisk

Name: Communications Port (COM1)
Description: Communications Port
Class Guid: {4D36E978-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard port types)
Service: Serial

Name: Communications Port (COM2)
Description: Communications Port
Class Guid: {4D36E978-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard port types)
Service: Serial

Name: Printer Port (LPT1)
Description: Printer Port
Class Guid: {4D36E978-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard port types)
Service: Parport

Name: Printer Port Logical Interface
Description: Printer Port Logical Interface
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service:

Name: PS/2 Compatible Mouse
Description: PS/2 Compatible Mouse
Class Guid: {4D36E96F-E325-11CE-BFC1-08002BE10318}
Manufacturer: Microsoft
Service: i8042prt

Name: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
Description: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
Class Guid: {4D36E96B-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard keyboards)
Service: i8042prt

Name: Standard Game Port
Description: Standard Game Port
Class Guid: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service: gameenum

Name: ACPI Fixed Feature Button
Description: ACPI Fixed Feature Button
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service:

Name: Logical Disk Manager
Description: Logical Disk Manager
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service: dmio

Name: Volume Manager
Description: Volume Manager
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service: ftdisk

Name: Generic volume
Description: Generic volume
Class Guid: {71A27CDD-812A-11D0-BEC7-08002BE2092F}
Manufacturer: Microsoft
Service:

Name: AFD Networking Support Environment
Description: AFD Networking Support Environment
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: AFD

Name: ASCTRM
Description: ASCTRM
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ASCTRM

Name: Beep
Description: Beep
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: Beep

Name: catchme
Description: catchme
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: catchme

Name: dmboot
Description: dmboot
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: dmboot

Name: dmload
Description: dmload
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: dmload

Name: Fips
Description: Fips
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: Fips

Name: Generic Packet Classifier
Description: Generic Packet Classifier
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: Gpc

Name: HTTP
Description: HTTP
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: HTTP

Name: IP Traffic Filter Driver
Description: IP Traffic Filter Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: IpFilterDriver

Name: IP Network Address Translator
Description: IP Network Address Translator
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: IpNat

Name: IPSEC driver
Description: IPSEC driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: IPSec

Name: ksecdd
Description: ksecdd
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ksecdd

Name: MBAMSwissArmy
Description: MBAMSwissArmy
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: MBAMSwissArmy

Name: mnmdd
Description: mnmdd
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: mnmdd

Name: mountmgr
Description: mountmgr
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: mountmgr

Name: NDIS System Driver
Description: NDIS System Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: NDIS

Name: Remote Access NDIS TAPI Driver
Description: Remote Access NDIS TAPI Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: NdisTapi

Name: NDIS Usermode I/O Protocol
Description: NDIS Usermode I/O Protocol
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: Ndisuio

Name: NDProxy
Description: NDProxy
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: NDProxy

Name: NetBios over Tcpip
Description: NetBios over Tcpip
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: NetBT

Name: NTSIM
Description: NTSIM
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: NTSIM

Name: Null
Description: Null
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: Null

Name: PartMgr
Description: PartMgr
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: PartMgr

Name: ParVdm
Description: ParVdm
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ParVdm

Name: Remote Access Auto Connection Driver
Description: Remote Access Auto Connection Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: RasAcd

Name: RDPCDD
Description: RDPCDD
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: RDPCDD

Name: SetupNT
Description: SetupNT
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: SetupNT

Name: TCP/IP Protocol Driver
Description: TCP/IP Protocol Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: Tcpip

Name: VgaSave
Description: VgaSave
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: VgaSave

Name: VIA AGP Bus Filter
Description: VIA AGP Bus Filter
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: viaagp

Name: VolSnap
Description: VolSnap
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: VolSnap

Name: Remote Access IP ARP Driver
Description: Remote Access IP ARP Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: Wanarp

Name: Windows Socket 2.0 Non-IFS Service Provider Support Environment
Description: Windows Socket 2.0 Non-IFS Service Provider Support Environment
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: WS2IFSL

Name: Audio Codecs
Description: Audio Codecs
Class Guid: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service: audstub

Name: Legacy Audio Drivers
Description: Legacy Audio Drivers
Class Guid: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service: audstub

Name: Media Control Devices
Description: Media Control Devices
Class Guid: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service: audstub

Name: Legacy Video Capture Devices
Description: Legacy Video Capture Devices
Class Guid: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service: audstub

Name: Video Codecs
Description: Video Codecs
Class Guid: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service: audstub

Name: WAN Miniport (L2TP)
Description: WAN Miniport (L2TP)
Class Guid: {4D36E972-E325-11CE-BFC1-08002BE10318}
Manufacturer: Microsoft
Service: Rasl2tp

Name: WAN Miniport (IP)
Description: WAN Miniport (IP)
Class Guid: {4D36E972-E325-11CE-BFC1-08002BE10318}
Manufacturer: Microsoft
Service: NdisWan

Name: WAN Miniport (PPPOE)
Description: WAN Miniport (PPPOE)
Class Guid: {4D36E972-E325-11CE-BFC1-08002BE10318}
Manufacturer: Microsoft
Service: RasPppoe

Name: WAN Miniport (PPTP)
Description: WAN Miniport (PPTP)
Class Guid: {4D36E972-E325-11CE-BFC1-08002BE10318}
Manufacturer: Microsoft
Service: PptpMiniport

Name: Direct Parallel
Description: Direct Parallel
Class Guid: {4D36E972-E325-11CE-BFC1-08002BE10318}
Manufacturer: Microsoft
Service: Raspti

Name: Terminal Server Device Redirector
Description: Terminal Server Device Redirector
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service: rdpdr

Name: Terminal Server Keyboard Driver
Description: Terminal Server Keyboard Driver
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service: TermDD

Name: Terminal Server Mouse Driver
Description: Terminal Server Mouse Driver
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service: TermDD

Name: Plug and Play Software Device Enumerator
Description: Plug and Play Software Device Enumerator
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service: swenum

Name: Microcode Update Device
Description: Microcode Update Device
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service: update

Name: Microsoft System Management BIOS Driver
Description: Microsoft System Management BIOS Driver
Class Guid: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard system devices)
Service: mssmbios


========================= Memory info: ===================================

Percentage of memory in use: 73%
Total physical RAM: 191.48 MB
Available physical RAM: 51.13 MB
Total Pagefile: 935.17 MB
Available Pagefile: 731.86 MB
Total Virtual: 2047.88 MB
Available Virtual: 1981.24 MB

========================= Partitions: =====================================

2 Drive c: (GADGET65432) (Fixed) (Total:19.07 GB) (Free:3.12 GB) FAT32

========================= Users: ========================================

User accounts for \\

Administrator Guest HelpAssistant
oem SUPPORT_388945a0

========================= Minidump Files ==================================

No minidump file found

**** End of log ****






Then I ran the MalwareBytes Program Quick Scan and this is the log I get:
Malwarebytes Anti-Malware (Corporate) 1.61.0.1400
www.malwarebytes.org

Database version: v2012.04.14.04

Windows XP Service Pack 2 x86 FAT32
Internet Explorer 6.0.2900.2180
oem :: U9J7V0 [administrator]

Protection: Disabled

4/14/2012 5:54:21 PM
mbam-log-2012-04-14 (17-54-21).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 211669
Time elapsed: 10 minute(s), 28 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)



So..Now I'm suppose to post a gmer.log and I can't find the place where it lets you save a log. I downoaded the gmer file, opened it, watched it automatically do what it was suppose to, then clicked the scan button and it seemed like it did its scan.. but nothing popped up to give me an option to save a log file or anything. What do I do now?

Edited by dashizen, 14 April 2012 - 06:26 PM.


BC AdBot (Login to Remove)

 


#2 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,658 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:06:23 AM

Posted 14 April 2012 - 06:15 PM

Total physical RAM: 191.48 MB

With that little of RAM your computer will always be slow.
You need more RAM for starters.

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#3 dashizen

dashizen
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:FL
  • Local time:08:23 AM

Posted 14 April 2012 - 06:30 PM

Total physical RAM: 191.48 MB

With that little of RAM your computer will always be slow.
You need more RAM for starters.


Ok.. Can I do anything else in the mean time though? Getting more RAM right now's not an option and before the virus, my computer wasn't that slow.

#4 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,658 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:06:23 AM

Posted 14 April 2012 - 06:35 PM

I don't see anything malicious on your computer.
What does make you think you're infected?

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#5 dashizen

dashizen
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:FL
  • Local time:08:23 AM

Posted 14 April 2012 - 07:42 PM

I don't see anything malicious on your computer.
What does make you think you're infected?

I guess because it didn't use to freeze up every time I would go on the internet, and the only way I can get it to do much of anything is if I kill the SVCHOST.EXE process that's taking up most of the memory...then the internet page loads, or whatever program I was trying to load ends up loading and then it freezes up again a few seconds later, and I have to kill the next SVCHOST.EXE process that starts eating up the memory, and then the program finishes loading. I shouldn't have to be monitoring the processes and killing SVCHOST.EXE every few seconds to get anything done on the computer.

The research I did a few days ago made me think that I had the virus that makes it so you can't use firefox. All the stuff I read is kind of all garbled now in my head so I'm not really sure why I came to this conclusion- but I think it was doing things that some kind of system32 virus does to your computer. I also remember something weird happening where all of a sudden Ask.com was my homepage..or maybe it was bing.com.. and then there were all these duplicate file folders and hidden folders and some I can't delete... Sorry this is not very organized..Just trying to recollect everything.

Everything was fine until a certain somebody probably used my computer to look at some certain websites that tend to make your computer have a virus. I think there is stuff in the registry that needs to get wiped out but I don't know which stuff that is.

Do you think running the gmer scan and being able to generate a log of that would give you any more information? If so, I guess I need some help trying to save a log. Thanks for your responses so far :)

Edited by dashizen, 14 April 2012 - 07:44 PM.


#6 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,658 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:06:23 AM

Posted 14 April 2012 - 08:15 PM

Please download GMER from one of the following locations and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

    Posted Image
  • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

IMPORTANT! If for some reason GMER refuses to run, try again.
If it still fails, try to UN-check "Devices" in right pane.
If still no joy, try to run it from Safe Mode.

=====================================================================

Download aswMBR to your desktop.
Double click the aswMBR.exe to run it.
If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
Click the "Scan" button to start scan.
On completion of the scan click "Save log", save it to your desktop and post in your next reply.

NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#7 dashizen

dashizen
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:FL
  • Local time:08:23 AM

Posted 15 April 2012 - 10:21 AM

Ok, When I go into safe mode there's an option to log in as an Administrator (not sure why I never have that option when I log in normally)

Here are 2 logs of GMER(1st one in safe mode as administrator, 2nd one as user Tiffany in normal mode)

1)

Gmerlog run in safe mode as Administrator

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-04-15 12:21:49
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 Maxtor_2B020H1 rev.WAH21PB0
Running: riqqmpkk.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\uwldapow.sys


---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@RequireSignedAppInit_DLLs 1

---- EOF - GMER 1.0.15 ----


2) gmer log run in normal mode as user "Tiffany"

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-04-15 12:34:20
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 Maxtor_2B020H1 rev.WAH21PB0
Running: riqqmpkk.exe; Driver: C:\DOCUME~1\oem\LOCALS~1\Temp\uwldapow.sys


---- Kernel code sections - GMER 1.0.15 ----

LOCKcodeÿÿÿÿUSRoslbAentry point in "LOCKcodeÿÿÿÿUSRoslbAentry point in "" section [0xFB064320] C:\WINDOWS\System32\DRIVERS\USRoslbA.sys entry point in "LOCKcodeÿÿÿÿUSRoslbAentry point in "" section [0xFB064320]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@RequireSignedAppInit_DLLs 1

---- EOF - GMER 1.0.15 ----


Here are logs of aswMBR

1) In NORMAL mode as user "Tiffany"

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-04-15 10:42:26
-----------------------------
10:42:26.140 OS Version: Windows 5.1.2600 Service Pack 2
10:42:26.140 Number of processors: 1 586 0x2C02
10:42:26.140 ComputerName: U9J7V0 UserName: oem
10:42:27.578 Initialize success
10:51:03.406 AVAST engine defs: 12041501
11:02:06.546 The log file has been saved successfully to "C:\Documents and Settings\oem\Desktop\aswMBR1.txt"
11:02:12.343 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
11:02:12.343 Disk 0 Vendor: Maxtor_2B020H1 WAH21PB0 Size: 19540MB BusType: 3
11:02:12.453 Disk 0 MBR read successfully
11:02:12.453 Disk 0 MBR scan
11:02:16.937 Disk 0 unknown MBR code
11:02:16.953 Disk 0 Partition 1 80 (A) 0C FAT32 LBA MSWIN4.1 19539 MB offset 63
11:02:20.187 Disk 0 scanning sectors +40017915
11:02:20.296 Disk 0 scanning C:\WINDOWS\system32\drivers
11:03:00.781 Service scanning
11:03:21.937 Modules scanning
11:03:50.781 Disk 0 trace - called modules:
11:03:50.796 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys viaide.sys PCIIDEX.SYS
11:03:50.812 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x81b01780]
11:03:51.140 3 CLASSPNP.SYS[fab9d05b] -> nt!IofCallDriver -> \Device\00000059[0x81aa0f18]
11:03:51.140 5 ACPI.sys[bafb7620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x81a9f030]
11:03:52.421 AVAST engine scan C:\WINDOWS
11:04:12.562 AVAST engine scan C:\WINDOWS\system32
11:07:15.046 AVAST engine scan C:\WINDOWS\system32\drivers
11:07:26.421 AVAST engine scan C:\Documents and Settings\oem
11:09:21.125 AVAST engine scan C:\Documents and Settings\All Users
11:09:42.656 Scan finished successfully
11:18:33.796 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\oem\Desktop\MBR.dat"
11:18:33.796 The log file has been saved successfully to "C:\Documents and Settings\oem\Desktop\aswMBR2.txt"

2) In SAFE MODE as ADMINISTRATOR

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-04-15 13:04:04
-----------------------------
13:04:04.843 OS Version: Windows 5.1.2600 Service Pack 2
13:04:04.843 Number of processors: 1 586 0x2C02
13:04:04.843 ComputerName: U9J7V0 UserName:
13:04:06.453 Initialize success
13:04:22.656 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
13:04:22.703 Disk 0 Vendor: Maxtor_2B020H1 WAH21PB0 Size: 19540MB BusType: 3
13:04:22.781 Disk 0 MBR read successfully
13:04:22.828 Disk 0 MBR scan
13:04:22.875 Disk 0 unknown MBR code
13:04:22.921 Disk 0 Partition 1 80 (A) 0C FAT32 LBA MSWIN4.1 19539 MB offset 63
13:04:22.984 Disk 0 scanning sectors +40017915
13:04:23.109 Disk 0 scanning C:\WINDOWS\system32\drivers
13:04:37.765 Service scanning
13:05:26.562 Modules scanning
13:05:40.281 Disk 0 trace - called modules:
13:05:40.406 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys viaide.sys
13:05:40.453 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x81ab59c0]
13:05:40.515 3 CLASSPNP.SYS[fab9d05b] -> nt!IofCallDriver -> \Device\00000059[0x81a540b8]
13:05:40.562 5 ACPI.sys[fab13620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x81a542a8]
13:05:44.531 Scan finished successfully
13:07:53.421 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\oem\My Documents\MBR.dat"
13:07:53.484 The log file has been saved successfully to "C:\Documents and Settings\oem\My Documents\aswMBRloginsafemodeasadmin.txt"


While I wait for a reply, I'm going to probably do these steps in the mean time:


Slow Computer Checklist

Because many members post about their computer responding slowly, BC is posting a summary checklist of general steps a member can take to resolve this problem, and briefly discussing the three most common causes: malware, uncontrolled applications, and lack of maintenance.

Malware

Perhaps the greatest contributor to a poorly performing computer is malware. Usually this is associated with downloading an application that contains spyware, by not having browser security settings high enough, by carelessly downloading P2P files, or by failing to install security patches in a timely manner.

Step 1. Update the definitions of your anti-virus and run a complete scan of your hard drive in Safe Mode. Resolve any unfixable issues. Note that some viruses require additional steps before they can be removed; usually a websearch will find specific instructions or a special removal tool. If you cannot find a solution, use the BC forums to request help.

Step 2. If the sluggishness is sudden, and you have recently downloaded an application, the problem may reside there. Test this by completely removing it. A wise user will generally perform a websearch about the application before downloading it because in most cases, any potential problem with malware or poor performance will have surfaced.

Step 3. Adware and Spyware can drastically effect your computer’s performance, and these are all over the Internet. A very recent study indicated that one out of every 20 executable files on Web sites is spyware, and 1 in 25 domains contain at least one piece of spyware waiting for victims.
Update the definitions of your anti-spyware applications and scan your hard drives in Safe Mode. Experienced users will regularly run two or three of these applications, because each company has its own criteria for what constitutes spyware and will only search against their own set. (A list of very good, free anti-spyware applications is provided by BC). Again, resolve any open issues before proceeding to the next step.

For further reading about Malware and some malware removal applications, use BC’s Tutorial section; most of the applications have very good Help files that explain how they work as well as the unique features of each.


Uncontrolled Applications

Step 4. Review applications that self-launch on startup. You computer can be a battleground for your attention. Many programs, for instance, install a quick-launch feature that allows them to be opened quickly; other programs will include an automatic update feature that requires them to be running in the background. Each of these slows down your launching Windows and each requires a small bit of resources while your computer is running.
The easiest way to review and than to manage start-ups is to use one of the many small utilities available (see the BC list of free applications). If, for example, you have Spybot Search and Destroy, you can use its startup tool that lists startups and allows you to turn off any you do not need. If you are unsure about what can be safely deleted, remember that BC maintains a very comprehensive Startup Database that includes information about whether the questioned item is needed, optional, or not needed.
At the same time, remember that all those icons on your Desktop also take a small amount of boot time to place themselves.

Lack of Maintenance

Step 5. Clean up your hard drive (preparation for Step 7). Delete unused programs and transfer old files to a CD. Unplayed games, lots of family pictures, zipped files that you have already opened, applications you have not used in two years, software for that old printer you threw away last year---these are some examples of files you can delete. Then use Window’s Disk Cleanup to delete temporary internet files, temporary PC health files, etc..

(Note for advanced users: some experts would include the additional maintenance step of cleaning up the Windows registry, and there are several applications to help do this. For the most part, registry maintenance will not make a significant difference, and unless you are very comfortable with Windows, and carefully make backups of the registry, you can do serious harm by making registry changes, so this step is not included.)

Step 6. Run scandisk/checkdisk in Safe Mode. Have it repair anything it finds.

Step 7. Defragment your computer. Windows tends to put new files in any available open space; defragging will place associated segments of files closer together so your read arm has less travelling around the hard drive to do, saving wear and tear while speeding up programs.



Hopefully, now that you have have finished, you will see a marked improvement in computer performance. However, if you complete these steps and your computer is still sluggish, then the next step is to submit your problem to the BC user community for more detailed help. The problem, for example, may be application/operating system specific or turn into a hardware issue.


References:
Step 1 - Safe Mode
Step 3 - A list of very good, free anti-spyware applications is provided by BC
.... use BC’s Tutorial section.
Spyware study:
http://www.informationweek.com/windows/sho...cleID=179102695
Step 4 - (see the BC list of free applications)

This post has been edited by Blade Zephon: 26 January 2011 - 01:35 AM
Reason for edit: Update Link

Edited by dashizen, 15 April 2012 - 01:16 PM.


#8 dashizen

dashizen
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:FL
  • Local time:08:23 AM

Posted 15 April 2012 - 01:34 PM

I also ran the MalwareBytes software in safemode as the Administrator and it found 1 object in the registry scan, which I clicked to have removed. Here's the log:


Malwarebytes Anti-Malware (Corporate) 1.61.0.1400
www.malwarebytes.org

Database version: v2012.04.15.03

Windows XP Service Pack 2 x86 FAT32 (Safe Mode)
Internet Explorer 6.0.2900.2180
Administrator :: U9J7V0 [administrator]

Protection: Disabled

4/15/2012 1:09:42 PM
mbam-log-2012-04-15 (13-09-42).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 211012
Time elapsed: 7 minute(s), 24 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|StartMenuLogoff (PUM.Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

#9 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,658 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:06:23 AM

Posted 15 April 2012 - 01:59 PM

I don't really see much there.

Download Temp File Cleaner (TFC)
Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

=============================================================================

Please run a free online scan with the ESET Online Scanner

  • Disable your antivirus program
  • Tick the box next to YES, I accept the Terms of Use
  • Click Start
  • Accept any security warnings from your browser.
  • Check Scan archives
  • Click Start
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click on List of found threats
  • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    NOTE. If Eset doesn't find any threats it'll NOT produce any log.

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#10 dashizen

dashizen
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:FL
  • Local time:08:23 AM

Posted 15 April 2012 - 09:42 PM

Ok. Nothing was detected. Now what do I do?

#11 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,658 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:06:23 AM

Posted 15 April 2012 - 09:44 PM

Well, as I suspected before your computer is clean.
If you want it to be faster you need more RAM.

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#12 dashizen

dashizen
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:FL
  • Local time:08:23 AM

Posted 16 April 2012 - 07:36 AM

Ok, I give. I'll get more RAM somehow. I have 2 sticks only 256MB each from a different computer...but only 1 slot available to add more RAM. Should I take the existing RAM out and put these 2 sticks in or should I just add one of these? And do I have to do anything fancy, or do I just stick em in there?

#13 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,658 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:06:23 AM

Posted 16 April 2012 - 10:12 AM

You have to make sure you're adding correct type of RAM.
To see what you need see here: http://www.crucial.com/index.aspx

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#14 dashizen

dashizen
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:FL
  • Local time:08:23 AM

Posted 17 April 2012 - 09:13 AM

Thanks!

#15 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,658 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:06:23 AM

Posted 17 April 2012 - 10:31 AM

You're very welcome Posted Image

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users